From 1195c554efcc66d044aaa0a06d7d1742c1a61997 Mon Sep 17 00:00:00 2001
From: Johan Dahlbom <jodahlbo@microsoft.com>
Date: Tue, 20 Oct 2026 17:37:42 +0200
Subject: [PATCH] Remove unsafe pull_request_target test trigger

Keep credentialed integration tests behind manual dispatch and the protected test environment. Limit the workflow token to read-only access and prevent checkout from persisting credentials.\n\nCo-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 .github/workflows/tests.yml | 16 +++-------------
 1 file changed, 3 insertions(+), 13 deletions(-)

diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 771ec8b6..96cb08bb 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -4,16 +4,8 @@ name: "AzOps - Tests"
 on:
   workflow_dispatch:
 
-  pull_request_target:
-    branches: [main]
-    paths:
-      - "src/**"
-      - "!src/AzOps.psd1"
-
 permissions:
-      id-token: write
-      contents: write
-      pull-requests: write
+  contents: read
 
 jobs:
   tests:
@@ -32,9 +24,8 @@ jobs:
       - name: "Checkout"
         uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
-          ref: ${{github.event.pull_request.head.sha}}
-          repository: ${{github.event.pull_request.head.repo.full_name}}
           fetch-depth: 0
+          persist-credentials: false
 
       # Dependencies
       - name: "Dependencies"
@@ -111,9 +102,8 @@ jobs:
       - name: "Checkout"
         uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
-          ref: ${{github.event.pull_request.head.sha}}
-          repository: ${{github.event.pull_request.head.repo.full_name}}
           fetch-depth: 0
+          persist-credentials: false
 
       # Dependencies
       - name: "Dependencies"